Table of Contents | ||||
---|---|---|---|---|
|
...
Comments | Users can add comments related to the investigation in this section. A good practice is adding a comment here any time you make a modification to the investigation. Simply write the comment in the text field and click Add. New comments will appear first. You can easily edit and delete comments by clicking the pencil and - icons. |
---|---|
Detections | If the investigation contains Detection-type alerts, you can check them here. |
Observations | If the investigation contains Observation-type alerts, you can check them here. |
Models | If the investigation contains Model-type alerts, you can check them here. |
Analytics | If the investigation contains Analytics-type alerts, you can check them here. |
Related investigations | Manually linked current investigations or investigations opened automatically by flows. |
Queries | Queries obtained from hunting. |
Enrichment | Enrichment obtained from the alerts involved in this investigation, from internal or external enrichment servers. |
Entities | Entities involved in this investigation. |
Files / Analysis | Upload files to be analyzed in the investigation. In this section, you can find three different tabs:
|
Associations | Click this button to check the associations of each entity involved in the investigation in a graph. This graph is the same that appears when you access the details of an alert in the Triage area. Learn more about it here. |
...